/********************************************************************************************
rUGP hook:
Process name is rugp.exe. Used by AGE/GIGA games.
Font caching issue. Find call to GetGlyphOutlineA and keep stepping out functions.
After several tries we comes to address in rvmm.dll and everything is catched.
We see CALL [E*X+0x*] while EBP contains the character data.
It's not as simple to reverse in rugp at run time as like reallive since rugp dosen't set
up stack frame. In other words EBP is used for other purpose. We need to find alternative
approaches.
The way to the entry of that function gives us clue to find it. There is one CMP EBP,0x8140
instruction in this function and that's enough! 0x8140 is the start of SHIFT-JIS
characters. It's dtermining if ebp contains a SHIFT-JIS character. This function is not likely
to be used in other ways. We simply search for this instruction and place hook around.
********************************************************************************************/
/********************************************************************************************
System40 hook:
System40 is a game engine developed by Alicesoft.
Afaik, there is 2 very different type of System40. Each requires a particular hook.
Pattern 1: Either SACTDX.dll or SACT2.dll exports SP_TextDraw.
The first relative call in this function draw text to some surface.
Text pointer is return by last absolute indirect call before that.
Split parameter is a little tricky. The first register pushed onto stack at the begining
usually is used as font size later. According to instruction opcode map, push
eax -- 50, ecx -- 51, edx -- 52, ebx --53, esp -- 54, ebp -- 55, esi -- 56, edi -- 57
Split parameter value:
eax - -8, ecx - -C, edx - -10, ebx - -14, esp - -18, ebp - -1C, esi - -20, edi - -24
Just extract the low 4 bit and shift left 2 bit, then minus by -8,
will give us the split parameter. e.g. push ebx 53->3 *4->C, -8-C=-14.
Somtimes if split function is enabled, ITH will split text spoke by different
character into different thread. Just open hook dialog and uncheck split parameter.
Then click modify hook.
Pattern 2: *engine.dll exports SP_SetTextSprite.
At the entry point, EAX should be a pointer to some structre, character at +0x8.
Before calling this function, the caller put EAX onto stack, we can also find this
value on stack. But seems parameter order varies from game release. If a future
game break the EAX rule then we need to disassemble the caller code to determine
data offset dynamically.
********************************************************************************************/